xx399 Privacy Policy

1Introduction and Scope

This Privacy Policy ("Policy") describes how xx399 ("the Platform", "we", "us", "our") collects, uses, stores, and discloses personal information about individuals ("you", "your", "the Member") who access or use the xx399 website and associated services available at xx399.io.

This Policy applies to all personal data collected through the xx399 website, mobile-optimised site, customer support channels, and any promotional communications we issue. It covers data collected at registration, during account operation, through payment processing, and via standard web analytics tools used to improve the platform experience.

This Policy should be read alongside the xx399 Terms & Conditions, which govern the broader contractual relationship between you and the platform. In the event of any conflict between this Policy and the Terms & Conditions regarding data-related matters, this Policy shall prevail.

2Data Controller Information

xx399 acts as the data controller for all personal data collected from members and visitors of the xx399 platform. As the data controller, xx399 determines the purposes and means by which personal data is processed.

For any privacy-related queries, requests to exercise your data rights, or concerns regarding this Policy, you may contact the xx399 Data Privacy team using the following contact detail:

3Personal Data We Collect

xx399 collects personal data through several means, including information you provide directly, data generated automatically by your use of the platform, and information received from third-party service providers. The categories of personal data we collect include:

3.1 Registration and Identity Data

• Full name as it appears on your government-issued identity document.
• Date of birth for the purpose of verifying that you meet the 21+ age requirement.
• Bangladeshi mobile number used as your primary account identifier and for OTP authentication.
• Email address for account notifications and support communications.
• National Identity Card (NID) number or passport number, where identity verification is required.
• Residential address in Bangladesh, collected during enhanced verification procedures.

3.2 Financial and Transaction Data

• Mobile banking account numbers associated with bKash, Nagad, Rocket, and Upay transactions.
• Bank account details where bank transfer is used as a deposit or withdrawal channel.
• Transaction histories, including deposit amounts, withdrawal requests, bet records, and bonus transactions.
• Note: xx399 does not store full card numbers, mobile banking PINs, or net banking passwords.

3.3 Technical and Usage Data

• IP address and approximate geographic location (city/region level).
• Device type, operating system, browser type, and version.
• Session duration, pages visited, games accessed, and betting activity logs.
• Login timestamps and authentication event records for security purposes.

3.4 Communications Data

• Records of communications with the xx399 customer support team via email or live chat.
• Feedback and survey responses where voluntarily provided.
• Promotional communication preferences and opt-in/opt-out records.

4How We Use Your Data

xx399 processes your personal data for specific, legitimate purposes directly connected to the operation of the platform and the provision of our betting and casino services to Bangladesh members. We do not process your data for any purpose incompatible with those listed below:

• Account creation and management: To register your account, verify your identity, and maintain your membership profile throughout your relationship with xx399.
• Age and identity verification: To confirm that you meet the mandatory 21+ age requirement and that you are who you claim to be, in compliance with responsible gaming obligations.
• Payment processing: To facilitate deposits via bKash, Nagad, Rocket, Upay, and bank channels, and to process withdrawal requests to your verified payment method.
• Platform security and fraud prevention: To detect and prevent fraudulent activity, multi-accounting, bonus abuse, money laundering, and other prohibited behaviours that could harm the platform or its members.
• Customer support: To respond to your enquiries, resolve disputes, process complaints, and provide technical assistance when required.
• Responsible gaming: To monitor gaming patterns, apply self-exclusion requests, enforce deposit limits, and deliver responsible gaming interventions where appropriate.
• Legal and regulatory compliance: To meet obligations imposed by applicable anti-money laundering (AML) regulations, record-keeping requirements, and any lawful requests from regulatory or law enforcement authorities.
• Platform improvement: To analyse usage patterns, identify technical issues, and improve the overall quality of the xx399 betting and casino experience.
• Marketing communications: To send promotional offers, bonus announcements, and relevant platform updates to members who have opted in to receive such communications.

5Legal Basis for Processing

xx399 processes your personal data on one or more of the following legal bases, depending on the nature of the processing activity:

• Contractual necessity: Processing required to fulfil our obligations under the Terms & Conditions — including account management, payment processing, and bet settlement.
• Legal obligation: Processing required to comply with applicable laws, including AML regulations, age verification requirements, and lawful requests from authorities.
• Legitimate interests: Processing carried out for purposes such as fraud prevention, platform security, and service improvement, where these interests are not overridden by your fundamental rights.
• Consent: Processing for marketing communications and optional data uses, where you have provided explicit and freely given consent that may be withdrawn at any time.

6Data Sharing and Disclosure

xx399 does not sell your personal data. We share personal data only in the limited circumstances described below, and only to the minimum extent necessary for each purpose:

• Payment service providers: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, and other banking partners receive the financial data necessary to process your deposit and withdrawal transactions.
• Identity verification providers: Third-party KYC (Know Your Customer) service providers who assist in verifying the identity and age of members during the verification process.
• Technology and hosting providers: Cloud infrastructure, database hosting, and platform security vendors who process data solely on our instructions under data processing agreements.
• Regulatory and law enforcement authorities: Where required by applicable law, court order, or formal regulatory request, xx399 may disclose personal data to the relevant authorities. We will notify you of such requests where legally permitted to do so.
• Business successors: In the event of a merger, acquisition, or transfer of the xx399 business, your data may be transferred to the successor entity, subject to equivalent privacy protections.

7Cookies and Tracking Technologies

The xx399 platform uses cookies and similar technologies to ensure correct platform functionality, maintain your login session, and collect anonymised performance analytics. The cookies deployed by xx399 fall into the following categories:

• Strictly necessary cookies: Required for the platform to function correctly. These include session cookies that keep you logged in as you navigate between pages and security cookies that protect against cross-site request forgery (CSRF) attacks. These cannot be disabled without impairing platform functionality.
• Performance and analytics cookies: Used to collect anonymised data about how members use the platform — such as which pages are visited most frequently, average session duration, and error rates. This data helps us identify areas for improvement.
• Functional cookies: Used to remember your preferences, such as your preferred language setting or display options, to provide a more personalised experience on return visits.

xx399 does not use third-party advertising cookies, retargeting pixels, or social media tracking scripts on the platform. You may configure your browser to block or delete cookies, though doing so may affect your ability to use certain platform features, including maintaining an active login session.

8Data Retention

xx399 retains your personal data for as long as your account remains active and for a defined period after account closure, as required to meet legal obligations and resolve any outstanding disputes. The general retention periods applied are as follows:

• Active account data: Retained for the duration of your membership and updated as your account information changes.
• Transaction and financial records: Retained for a minimum of five years following the date of each transaction, in compliance with applicable AML record-keeping requirements.
• Identity verification documents: Retained for five years following account closure or the date of the last transaction, whichever is later.
• Customer support records: Retained for three years following the resolution of the relevant enquiry or dispute.
• Technical and usage logs: Retained for up to twelve months for security monitoring purposes, after which they are anonymised or deleted.

Following the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with you as an individual.

9Your Rights and Choices

As an xx399 member whose personal data we process, you hold the following rights with respect to your information. To exercise any of these rights, contact us at [email protected] with the subject line "Privacy Request":

• Right of access: You may request a copy of the personal data xx399 holds about you, along with information about how it is used.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data held in your account profile.
• Right to erasure: In certain circumstances, you may request deletion of your personal data. Note that we may be required to retain certain data to comply with legal obligations even after an erasure request.
• Right to restriction: You may request that we restrict the processing of your personal data in specific circumstances, such as while a correction request is being assessed.
• Right to data portability: You may request a copy of data you have provided to xx399 in a structured, machine-readable format.
• Right to withdraw consent: Where processing is based on your consent (such as marketing communications), you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to object: You may object to processing based on legitimate interests where you have grounds relating to your particular situation.

xx399 will respond to all verifiable privacy requests within five business days. We may need to verify your identity before processing a request to protect your data from unauthorised access.

10Data Security

xx399 implements a layered security architecture to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. The primary technical and organisational measures in place include:

• 256-bit SSL/TLS encryption for all data in transit between your device and the xx399 platform.
• AES-256 encryption for sensitive data stored at rest in our databases, including identity documents and financial records.
• Multi-factor authentication (MFA) requirements for all administrative access to systems holding personal data.
• Role-based access controls ensuring that staff members access only the personal data necessary for their specific function.
• Regular security audits and penetration testing conducted by independent third-party security professionals.
• Intrusion detection and monitoring systems operating continuously to identify and respond to suspicious activity.

11Children and Minors

The xx399 platform is strictly intended for adults aged 21 and above. xx399 does not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from a minor, we will take immediate steps to delete that data and close the associated account.

If you believe that a minor has registered an account on the xx399 platform or that we may have inadvertently collected data from someone under 21, please contact us immediately at [email protected] so that we can investigate and take appropriate action without delay.

12Changes to This Policy

xx399 may update this Privacy Policy from time to time to reflect changes in our data practices, applicable legal requirements, or the services we offer. When material changes are made, we will notify registered members by email to their registered address and by posting a prominent notice on the xx399 platform prior to the changes taking effect.

The date of the most recent revision is displayed at the top of this document. Your continued use of the xx399 platform following the effective date of any revision constitutes your acceptance of the updated Policy. If you do not agree with the revised Policy, you should cease using the platform and may request account closure by contacting support.